An introduction to defensive, blue-team practice. Students learn to monitor systems and networks, detect and classify indicators of compromise, investigate events with a SIEM, perform basic incident response and introductory digital-forensics tasks, and respond to common incidents. Students also examine how AI-driven detection tools enhance monitoring while introducing new adversarial attack surfaces that must be secured.